Given that _elf_lookup (and thus, _do_lookup) cannot possibly return an
undefined symbol (due to the check for SHN_UNDEF in _elf_lookup), there's
no need for spurious checks for SHN_UNDEF on its return value.
Conflicts:
linker/linker.c
Change-Id: Ic73cf439924b45f72d4d9ba3f64a888c96cbbd9b
GDB needs the runtime linker's base address in order to
locate the latter's ".text" and ".plt" sections, for the
purpose of detecting solib trampolines. It also can
potentially use this to calculate the relocated address
of rtld_db_dlactivity.
Bug: http://code.google.com/p/android/issues/detail?id=34856
Change-Id: I63d3e7ae4e20a684ceb25967f2241e7d58dd685d
Signed-off-by: Ryan V. Bissell <ryan@bissell.org>
This test is designed to detect code such as:
int main() {
char buf[10];
memcpy(buf, "1234567890", sizeof(buf));
size_t len = strlen(buf); // segfault here with _FORTIFY_SOURCE
printf("%d\n", len);
return 0;
}
or anytime strlen reads beyond an object boundary. This should
help address memory leakage vulnerabilities and make other
unrelated vulnerabilities harder to exploit.
Change-Id: I354b425be7bef4713c85f6bab0e9738445e00182
In our previous FORTIFY_SOURCE change, we started using a custom
inline for memcpy(), rather than using GCC's __builtin_memcpy_chk().
This allowed us to delete our copy of __memcpy_chk(), and replace it
by __memcpy_chk2().
Apparently GCC uses __memcpy_chk() outside of __builtin_memcpy_chk().
Specifically, __memcpy_chk() is used by __builtin__memMOVE_chk() under
certain optimization levels.
Keep the old __memcpy_chk() function around, and have it call into
__memcpy_chk2().
Change-Id: I2453930b24b8a492a3b6ed860e18d92a6b762b80
Added va_end() for copied variable arguments lists
in __vfprintf() and __find_arguments().
This is by C standard.
Important for systems which pass arguments in registers.
Change-Id: I7ac42beaa6645bfe856c18132253352dae29ea37
Two changes:
1) Detect memory read overruns.
For example:
int main() {
char buf[10];
memcpy(buf, "abcde", sizeof(buf));
sprintf("%s\n", buf);
}
because "abcde" is only 6 bytes, copying 10 bytes from it is a bug.
This particular bug will be detected at compile time. Other similar
bugs may be detected at runtime.
2) Detect overlapping buffers on memcpy()
It is a bug to call memcpy() on buffers which overlap. For
example, the following code is buggy:
char buf3[0x800];
char *first_half = &buf3[0x400];
char *second_half = &buf3[1];
memset(buf3, 0, sizeof(buf3));
memcpy(first_half, second_half, 0x400);
printf("1: %s\n", buf3);
We now detect this at compile and run time.
Change-Id: I092bd89f11f18e08e8a9dda0ca903aaea8e06d91
memmove() unconditionally calls memcpy() if "dst" < "src". For
example, in the code below, memmove() would end up calling memcpy(),
even though the regions of memory overlap.
int main() {
char buf3[0x800];
char *dst = &buf3[1];
char *src = &buf3[0x400];
memset(buf3, 0, sizeof(buf3));
memmove(dst, src, 0x400);
printf("1: %s\n", buf3);
return 0;
}
Calling memcpy() on overlaping regions only works if you assume
that memcpy() copies from start to finish. On some architectures,
it's more efficient to call memcpy() from finish to start.
This is also triggering a failure in some of my code.
More reading:
* http://lwn.net/Articles/414467/
* https://bugzilla.redhat.com/show_bug.cgi?id=638477#c31 (comment 31)
Change-Id: I65a51ae3a52dd4af335fe5c278056b8c2cbd8948
libc's stack protector initialization routine (__guard_setup)
is in bionic/ssp.c. This code deliberately modifies the stack
canary. This code should never be compiled with -fstack-protector-all
otherwise it will crash (mismatched canary value).
Force bionic/ssp.c to be compiled with -fno-stack-protector
Change-Id: Ib95a5736e4bafe1a460d6b4e522ca660b417d8d6
limits.h relies on PAGE_SIZE being defined without actually including
page.h. Make sure this is included to avoid compilation failures.
Signed-off-by: Arun Raghavan <arun.raghavan@collabora.co.uk>
Add fortify_source support for openat(). This change requires that
an argument be supplied when using O_CREAT.
Fix unnecessary call to __open_2. If, at compile time, we know that
"flags" is constant and DOESN'T contain O_CREAT, the call to __open_2
is useless.
Change-Id: Ifcd29c4fb25e25656961d7552d672e161f0cfdbd
Since linker is built with -fvisibility=hidden rtld_db_dlactivity()
if hidden from gdb. Unhide it otherwise gdb may not know linker
activity and rescan solib
Change-Id: Ia8cd8d9738c6ea5696ba2ef0ebf2cf783f9ca70a
Prefix private functions with underscores, to prevent name
conflicts.
Use __error__ instead of error, since occasionally programs will
create their own "#define error ...".
Change-Id: I7bb171df58aec5627e61896032a140db547fd95d
Add a FORTIFY_SOURCE check which requires that you pass a
"mode" argument when calling open(..., O_CREAT). If a mode isn't
passed, then the file is created with "undefined" permissions.
Change-Id: I4427be4f9ce170c69da01af5b00fb05b03613a28
Use the functions in linker_phdr.c to load the PT_LOAD segments
in memory, and toggle their mapping's writable protection bit
as needed. In particular:
- when loading a library, load the segments then unprotected
them to allow relocations to work.
- when relocating the linker of the executable, unprotect
the segments loaded by the kernel to make relocations work
too.
- after all relocations are done, re-protect the segments,
and apply GNU RELRO protection if needed.
- just before calling the destructors, undo the GNU RELRO
protection.
Change-Id: I50e709f03958204b8d6140c0f51ebe24fe089a1b
This moves the code that determines where the .dynamic and .ARM.exidx
sections are to a single place in soinfo_link_image().
Change-Id: I98adcb440577bed86442349f03f3c629c945efec
